Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

False Positive alerts in DFM

I'm getting the following alert on one of our 6500's

Here is the alert:

EVENT ID = 0000UGP

ALERT ID = 00006IE

TIME = Tue 22-Jul-2008 03:34:28 EDT

STATUS = Active

SEVERITY = Critical

MANAGED OBJECT = bs029sws01.corp.citistreet.org

MANAGED OBJECT TYPE = Switches and Hubs

EVENT DESCRIPTION = OperationallyDown::Component=IF-bs029sws01.corp.citistreet.org/328 [Lo0] [172.18.254.247];ComponentClass=Interface;ComponentEventCode=1075;Type=SOFTWARELOOPBACK;IsFlapping=false;AdminStatus=UP;MaxSpeed=8000000000;OperStatus=DOWN;InterfaceCode=CODEUNK

CUSTOMER IDENTIFICATION = Networkers

I did a show logging and I see nothing in regards to what the alert is stating.

Please advise.

4 REPLIES
Cisco Employee

Re: False Positive alerts in DFM

This might only be visible by SNMP, and would point to a bug on the device. Try polling the ifOperStatus of Lo0 to see if it is going down. If the event has since cleared, it may be that the problem was transient, and you'll need a sniffer trace of DFM's polling to catch it again.

New Member

Re: False Positive alerts in DFM

Hi JClarke,

It seems to be a pattern the alert kicked off around 03:34 Monday am and 03:34 Tuesday am and it clears 4 minutes later. The polling interval is set for 240 seconds.

Cisco Employee

Re: False Positive alerts in DFM

You'll need to start a sniffer trace around that time to capture what DFM is polling. If the switch is really saying Lo0 is down, then we have a device bug. Else there's a problem with DFM.

New Member

Re: False Positive alerts in DFM

Thanks for the info if it does the same thing in the morning. I will definitely put a sniffer on it to see what's going on during that time frame.

131
Views
0
Helpful
4
Replies